tjs-lang 0.8.3 → 0.8.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tjs-lang",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Type-safe JavaScript dialect with runtime validation, sandboxed VM execution, and AI agent orchestration. Transpiles TypeScript to validated JS with fuel-metered execution for untrusted code.",
   "keywords": [
     "typescript",

package/src/lang/runtime.test.ts

@@ -27,6 +27,8 @@ import {
   isNativeType,
   Is,
   IsNot,
+  Eq,
+  NotEq,
   tjsEquals,
   checkType,
   MonadicError,
@@ -1178,3 +1180,47 @@ describe('predicate reason strings', () => {
     expect(err!.reason).toBeUndefined()
   })
 })
+
+// `==`/`!=` (which transpile to Eq/NotEq under TjsEquals) are **footgun-free
+// `===`**, NOT structural. They unwrap boxed primitives and treat null/undefined
+// as equal — but distinct objects/arrays are genuinely distinct (a real
+// distinction, and structural `==` would be a silent O(n) perf hit). Deep
+// structural comparison is the separate `Is`/`IsNot` function. This block pins
+// that design so docs/behavior can't drift back to "== is structural".
+describe('equality semantics — == (Eq) is footgun-free, NOT structural', () => {
+  it('fixes the boxed-primitive footgun (unlike ===)', () => {
+    expect(Eq(new Boolean(false), false)).toBe(true)
+    expect(Eq(new Number(5), 5)).toBe(true)
+    expect(Eq(new String('x'), 'x')).toBe(true)
+  })
+
+  it('does NOT coerce across types (unlike JS ==)', () => {
+    expect(Eq('5', 5)).toBe(false)
+    expect(Eq('', false)).toBe(false)
+    expect(Eq(0, false)).toBe(false)
+    expect(Eq(1, true)).toBe(false)
+    expect(Eq(null, 0)).toBe(false)
+  })
+
+  it('treats null and undefined as equal; NaN as equal to itself', () => {
+    expect(Eq(null, undefined)).toBe(true)
+    expect(Eq(NaN, NaN)).toBe(true)
+  })
+
+  it('is NOT structural — distinct objects/arrays are distinct', () => {
+    expect(Eq({ a: 1 }, { a: 1 })).toBe(false)
+    expect(Eq([1, 2], [1, 2])).toBe(false)
+    const shared = { a: 1 }
+    expect(Eq(shared, shared)).toBe(true) // identity still holds
+    expect(NotEq([1, 2], [1, 2])).toBe(true)
+  })
+
+  it('Is/IsNot ARE structural — that is the deep-comparison path', () => {
+    expect(Is({ a: 1 }, { a: 1 })).toBe(true)
+    expect(Is([1, 2], [1, 2])).toBe(true)
+    expect(Is({ a: { b: [1] } }, { a: { b: [1] } })).toBe(true)
+    expect(IsNot([1, 2], [1, 3])).toBe(true)
+    // and Is is not fooled into structural-comparing unequal shapes
+    expect(Is({ a: 1 }, { a: 2 })).toBe(false)
+  })
+})

package/src/runtime.test.ts

@@ -596,8 +596,8 @@ describe('Edge Cases', () => {
     expect(result.result.res).toEqual({ value: 42 })
   })
 
-  describe('structural equality in expressions', () => {
-    it('== compares arrays structurally', async () => {
+  describe('footgun-free equality in expressions (== is NOT structural)', () => {
+    it('distinct arrays are NOT equal (== matches TJS, not structural)', async () => {
       const ast = {
         op: 'seq',
         steps: [
@@ -621,10 +621,10 @@ describe('Edge Cases', () => {
         ],
       } as any
       const result = await vm.run(ast, {})
-      expect(result.result.res).toBe(true)
+      expect(result.result.res).toBe(false) // distinct arrays — NOT structural
     })
 
-    it('== compares objects structurally', async () => {
+    it('distinct objects are NOT equal (== matches TJS, not structural)', async () => {
       const ast = {
         op: 'seq',
         steps: [
@@ -648,7 +648,7 @@ describe('Edge Cases', () => {
         ],
       } as any
       const result = await vm.run(ast, {})
-      expect(result.result.res).toBe(true)
+      expect(result.result.res).toBe(false) // distinct objects — NOT structural
     })
 
     it('== does not coerce types', async () => {
@@ -678,7 +678,7 @@ describe('Edge Cases', () => {
       expect(result.result.res).toBe(false) // no coercion
     })
 
-    it('!= returns true for structurally different objects', async () => {
+    it('!= returns true for distinct objects', async () => {
       const ast = {
         op: 'seq',
         steps: [

package/src/vm/equality.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'bun:test'
+import { evaluateExpr } from './runtime'
+
+/**
+ * AJS `==`/`!=` must match TJS `==` (Eq): footgun-free `===`, NOT structural.
+ * This used to do deep structural comparison in the VM — an early, unconsidered
+ * divergence from TJS `==` (so `[1,2] == [1,2]` was `true` in AJS but `false` in
+ * TJS). Now consistent: distinct objects/arrays are distinct; structural
+ * equality is an explicit operation, never `==`.
+ */
+const lit = (value: unknown) => ({ $expr: 'literal' as const, value })
+const evalEq = (op: '==' | '!=', a: unknown, b: unknown) =>
+  evaluateExpr(
+    { $expr: 'binary', op, left: lit(a), right: lit(b) } as any,
+    { state: {}, args: {} } as any
+  )
+
+describe('AJS == / != — footgun-free, NOT structural (consistent with TJS)', () => {
+  it('distinct arrays/objects are NOT equal (the divergence fix)', () => {
+    expect(evalEq('==', [1, 2], [1, 2])).toBe(false)
+    expect(evalEq('==', { a: 1 }, { a: 1 })).toBe(false)
+    expect(evalEq('!=', [1, 2], [1, 2])).toBe(true)
+  })
+
+  it('identity still holds for the same reference', () => {
+    const shared = { a: 1 }
+    expect(evalEq('==', shared, shared)).toBe(true)
+    const arr = [1, 2]
+    expect(evalEq('==', arr, arr)).toBe(true)
+  })
+
+  it('no type coercion', () => {
+    expect(evalEq('==', '5', 5)).toBe(false)
+    expect(evalEq('==', '', false)).toBe(false)
+    expect(evalEq('==', 0, false)).toBe(false)
+  })
+
+  it('unwraps boxed primitives', () => {
+    expect(evalEq('==', new Boolean(false) as any, false)).toBe(true)
+    expect(evalEq('==', new Number(5) as any, 5)).toBe(true)
+  })
+
+  it('null/undefined equal; NaN equal to itself', () => {
+    expect(evalEq('==', null, undefined)).toBe(true)
+    expect(evalEq('==', NaN, NaN)).toBe(true)
+    expect(evalEq('==', null, 0)).toBe(false)
+  })
+
+  it('scalars compare as expected', () => {
+    expect(evalEq('==', 1, 1)).toBe(true)
+    expect(evalEq('==', 'x', 'x')).toBe(true)
+    expect(evalEq('!=', 1, 2)).toBe(true)
+  })
+
+  it('=== / !== remain strict identity (unchanged)', () => {
+    expect(evalEq('===' as any, [1], [1])).toBe(false)
+    expect(evalEq('===' as any, 5, 5)).toBe(true)
+  })
+})

package/src/vm/runtime.ts

@@ -1,69 +1,36 @@
 import { s, validate, filter as schemaFilter } from 'tosijs-schema'
 
-/** Well-known symbol for custom equality (matches src/lang/runtime.ts) */
-const tjsEquals = Symbol.for('tjs.equals')
-
 /**
- * Structural equality for AJS expressions.
- * Mirrors the TJS Is() function: symbol → .Equals → structural.
+ * AJS `==`/`!=` equality — **footgun-free `===`**, consistent with TJS `Eq`
+ * (`src/lang/runtime.ts`). NOT structural: it unwraps boxed primitives, treats
+ * `null`/`undefined` as equal and `NaN` as equal to itself, but does NOT coerce
+ * across types, and distinct objects/arrays are distinct (`[1,2] != [1,2]`).
+ *
+ * (Originally the VM did deep structural comparison here — an early, unconsidered
+ * divergence from TJS `==`. It was also a SECURITY hole: a single `==` node costs
+ * a flat EXPR_FUEL_COST, but the structural walk charged nothing per element, so
+ * `==` on an attacker-controlled large structure was an unbounded-work / fuel-
+ * bypass DoS — exactly what AJS exists to prevent. `eqValue` is O(1).
+ *
+ * Structural equality is an explicit operation: in TJS it's the `Is`/`IsNot`
+ * function; AJS can grow an `Is` atom if/when needed — but it MUST be fuel-metered
+ * per element compared, or it reintroduces the same DoS.)
  */
-function isStructurallyEqual(a: unknown, b: unknown): boolean {
-  // Symbol protocol
-  if (
-    a !== null &&
-    typeof a === 'object' &&
-    typeof (a as any)[tjsEquals] === 'function'
-  ) {
-    return (a as any)[tjsEquals](b)
-  }
-  if (
-    b !== null &&
-    typeof b === 'object' &&
-    typeof (b as any)[tjsEquals] === 'function'
-  ) {
-    return (b as any)[tjsEquals](a)
+function eqValue(a: unknown, b: unknown): boolean {
+  if (a instanceof String || a instanceof Number || a instanceof Boolean) {
+    a = a.valueOf()
   }
-
-  // .Equals method
-  if (
-    a !== null &&
-    typeof a === 'object' &&
-    typeof (a as any).Equals === 'function'
-  ) {
-    return (a as any).Equals(b)
-  }
-  if (
-    b !== null &&
-    typeof b === 'object' &&
-    typeof (b as any).Equals === 'function'
-  ) {
-    return (b as any).Equals(a)
+  if (b instanceof String || b instanceof Number || b instanceof Boolean) {
+    b = b.valueOf()
   }
-
   if (a === b) return true
-
-  // Nullish equality (null == undefined)
-  if ((a === null || a === undefined) && (b === null || b === undefined))
+  if (typeof a === 'number' && typeof b === 'number' && isNaN(a) && isNaN(b)) {
     return true
-
-  if (a === null || a === undefined || b === null || b === undefined)
-    return false
-
-  if (typeof a !== typeof b) return false
-  if (typeof a !== 'object') return false
-
-  // Arrays
-  if (Array.isArray(a) && Array.isArray(b)) {
-    if (a.length !== b.length) return false
-    return a.every((v, i) => isStructurallyEqual(v, b[i]))
   }
-  if (Array.isArray(a) !== Array.isArray(b)) return false
-
-  // Objects
-  const keysA = Object.keys(a as object)
-  const keysB = Object.keys(b as object)
-  if (keysA.length !== keysB.length) return false
-  return keysA.every((k) => isStructurallyEqual((a as any)[k], (b as any)[k]))
+  if ((a === null || a === undefined) && (b === null || b === undefined)) {
+    return true
+  }
+  return false
 }
 
 // --- Monadic Error Type ---
@@ -1204,9 +1171,9 @@ export function evaluateExpr(node: ExprNode, ctx: RuntimeContext): any {
         case '<=':
           return left <= right
         case '==':
-          return isStructurallyEqual(left, right)
+          return eqValue(left, right)
         case '!=':
-          return !isStructurallyEqual(left, right)
+          return !eqValue(left, right)
         case '===':
           return left === right
         case '!==':